Please enable JavaScript.
Coggle requires JavaScript to display documents.
🐧 YAMA Linux Security Module (LSM) - Coggle Diagram
🐧 YAMA Linux Security Module (LSM)
🔰 1.1 Definition of Yama
Yama is a Linux Security Module (LSM)
It provides additional security restrictions on normal Linux processes
It protects sensitive process operations such as:
Process tracing
Debugging
Memory inspection
Privilege abuse prevention
Developed for:
Ubuntu
Debian
Enterprise Linux distributions
Security hardened systems
Main security goal:
Reduce unauthorized access between processes
🏛️ 2. Linux Security Module (LSM) Overview
Definition:
Framework inside Linux kernel that allows security modules
to enforce access control rules
LSM Examples:
SELinux
Mandatory Access Control
AppArmor
Application restriction
Yama
Process relationship protection
Smack
Tomoyo
Enterprise Purpose:
Defense in depth
Reduce attack surface
Prevent privilege escalation
⚙️ 3. Yama Main Security Features
🔍 3.1 Process Tracing Protection
Definition:
Controls which processes can inspect or debug
other processes
Protected operations:
ptrace()
gdb debugging
Process memory reading
Process injection attacks
Attack Example:
Malware attaches to SSH process
and steals credentials
🧠 4. Ptrace Security Control
Definition of ptrace
ptrace = Process Trace
Linux system call:
Allows one process to observe/control another process
Used by:
Debuggers
gdb
strace
Security tools
Security Risk:
Attackers can read another process memory
🔐 5. Yama ptrace_scope Control
Configuration File:
/proc/sys/kernel/yama/ptrace_scope
Permanent Configuration:
/etc/sysctl.conf
Runtime Configuration:
/etc/sysctl.d/
📊 6. ptrace_scope Values Explanation
0 = Classic ptrace permissions
Meaning:
Normal Linux ptrace rules apply
Same user processes can trace each other
Less secure
Enterprise Usage:
Development environments
1 = Restricted ptrace
Meaning:
Default Ubuntu setting
Process can trace child processes only
Parent-child relationship required
Better security
Enterprise Recommendation:
Production servers
2 = Admin-only ptrace
Meaning:
Only CAP_SYS_PTRACE capability users allowed
Normal users cannot debug processes
Strong security
Used For:
Banking servers
Government systems
Critical infrastructure
3 = No ptrace
Completely disables ptrace
Cannot be changed without reboot
Maximum restriction
🖥️ 7. Check Yama Status
Check kernel parameter:
Command:
cat /proc/sys/kernel/yama/ptrace_scope
🔧 8. Enable Yama
Check loaded security modules:
Command:
cat /sys/kernel/security/lsm
⚡ 9. Change Yama Setting Temporarily
Command:
sudo sysctl kernel.yama.ptrace_scope=1
Effect:
Applies immediately
Problem:
Lost after reboot
💾 10. Permanent Enterprise Configuration
Create configuration file:
sudo nano /etc/sysctl.d/99-yama-security.conf
Add:
kernel.yama.ptrace_scope = 1
Apply:
sudo sysctl --system
🏢 11. Enterprise Hardening Recommendation
Standard Server:
ptrace_scope = 1
High Security Server:
ptrace_scope = 2
Critical Infrastructure:
ptrace_scope = 3
Development Machine:
ptrace_scope = 0
🔎 12. Testing Yama Protection
Install debugging tool:
sudo apt install gdb
Find process:
ps aux
Try attach:
gdb -p PID
Expected:
Permission denied if blocked
🛡️ 13. Yama Against Attack Techniques
Credential Theft Prevention
Prevent memory scraping
Process Injection Prevention
Block unauthorized debugging
Malware Defense
Limit process manipulation
Privilege Escalation Reduction
Reduce lateral process access
📋 14. Monitoring and Auditing
Check configuration:
cat /proc/sys/kernel/yama/ptrace_scope
Audit system changes:
auditctl
Monitor kernel parameters:
sysctl -a
SIEM Integration:
OSSEC
Wazuh
Elastic SIEM
🚨 15. Troubleshooting
Problem:
Debugger cannot attach
Check:
cat /proc/sys/kernel/yama/ptrace_scope
Temporary disable:
sudo sysctl kernel.yama.ptrace_scope=0
Re-enable:
sudo sysctl kernel.yama.ptrace_scope=1
🏆 16. Enterprise Security Summary
Yama = Linux process protection layer
Main protection = ptrace restriction
Configuration = sysctl
Runtime path:
/proc/sys/kernel/yama/ptrace_scope
Permanent path:
/etc/sysctl.d/
Recommended production value:
ptrace_scope = 1
Security Benefit:
Prevent unauthorized process inspection,
debugging, and memory attacks